Terms of Service
Effective date: 29th August 2026
1. Information about us and these terms
1.1 These terms and conditions (the “Terms”) set out the basis on which Smudge Limited supplies the services described on www.smudgehosting.com (the “Services”). Our Services are website hosting (the “Hosting Service”) and domain name registration and renewal (the “Domain Service”).
1.2 Smudge Limited is a company registered in Guernsey under company number 57266, whose registered office is at Rivendell, 9 La Neuve Rue Estate, St Peter Port, Guernsey, GY1 1SF (“we”, “us”, “our”).
1.3 Please read these Terms carefully before ordering any Services. By ordering Services, you agree to be bound by them. If you do not accept these Terms you will not be able to order Services from us. We recommend you keep a copy for your records.
1.4 Schedule 1 (Data Processing Terms) forms part of these Terms and applies wherever we process personal data on your behalf. Where there is any conflict between Schedule 1 and the body of these Terms in respect of personal data, Schedule 1 prevails.
1.5 In these Terms, “your Material” means any data, content, software, website files, databases or other material that you or any person using your account uploads to, stores on, or transmits through the Services.
1.6 How we provide the Hosting Service. We provide the Hosting Service using infrastructure supplied to us by 20i Ltd, a company registered in England and Wales, which operates the datacentres and platform on which your Material is hosted. We remain your sole contracting party — your contract is with us, not with 20i, and you should raise all requests and complaints with us. Certain requirements of 20i’s own terms are passed on to you in these Terms, in particular at clauses 12 and 14, because we are required to pass them on and because our ability to provide the Hosting Service depends on them being met.
2. Your status
2.1 By placing an order you warrant that you are at least 18 years old and legally capable of entering into binding contracts.
2.2 If you are ordering on behalf of a company, partnership or other organisation, you warrant that you have authority to bind it, and that organisation will be the customer under these Terms.
2.3 Certain provisions of these Terms apply only to consumers (individuals acting wholly or mainly outside their trade, business, craft or profession) and are marked as such. Where a provision is expressed to apply to business customers, it does not apply to consumers.
3. Ordering and your account
3.1 You can only order Services once you have registered an account with us. The information you provide when registering must be complete and accurate, and you must keep it up to date. We may suspend access to your account and the Services if we reasonably believe the information you have supplied is inaccurate.
3.2 You are responsible for keeping your username and password confidential and for all activity carried out under your account. You must notify us promptly if you believe your credentials have been compromised.
3.3 Before you submit an order you will be shown a summary of the Services you have selected and the price payable, with an opportunity to correct any errors.
3.4 You will be required to register a valid payment method before you can place an order. We accept credit and debit cards and paperless direct debit; a credit or debit card may be required for your first order.
3.5 Once an order has been placed we will send confirmation of the Services ordered to the email address registered to your account. Copies of your invoices are available in your account.
4. How the contract is formed
4.1 Your order is an offer to buy Services from us. A contract (the “Contract”) is formed only when we send you an email accepting your order and, where relevant, confirming that your Hosting Service has been activated (the “Acceptance Confirmation”).
4.2 We may decline any order. If we do, we will tell you and will not charge you.
4.3 The Contract relates only to the Services confirmed in the Acceptance Confirmation. We are not obliged to supply any other Services until they have been confirmed.
5. Price and payment
5.1 The price of the Services is as quoted on our website at the time of your order. Prices are stated exclusive of any applicable taxes. Where any tax is chargeable on a supply to you, it will be shown separately before you complete your order.
5.2 The total cost of your order will be set out clearly before you submit it.
5.3 We may change our prices. We will give you at least 30 days’ written notice before an increase takes effect. You may cancel the affected Services without penalty at any time before the increase takes effect, by giving us notice in accordance with clause 9. If you do not cancel, the new price will apply from the date stated in the notice.
5.4 Despite our best efforts, a Service may occasionally be incorrectly priced. Where the correct price is lower than the price stated, we will charge the lower amount. Where the correct price is higher, we will contact you for instructions before accepting your order, and we are not obliged to supply at the incorrect lower price.
5.5 Payment for Services on a recurring term is taken in advance on each renewal date against the payment method registered to your account.
5.6 If a payment is not authorised, we may suspend the Services after giving you notice and a reasonable opportunity to correct your payment details.
5.7 Business customers only. Time for payment is of the essence. If you fail to pay on the due date we may charge interest and reasonable recovery costs in accordance with applicable law, and we may refer the debt to a recovery agent, in which case you will be liable for our reasonable costs of doing so.
6. Consumer cancellation rights
This clause 6 applies to consumers only.
6.1 Under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 you have the right to cancel the Contract within 14 calendar days beginning on the day after you receive the Acceptance Confirmation, without giving a reason.
6.2 By placing your order you expressly request that we begin supplying the Services immediately, before the end of that 14 day period, and you acknowledge that you will lose your right to cancel once the Services have been fully performed.
6.3 Because hosting and domain services are supplied on a continuing basis, they are not fully performed at the point you cancel. You therefore keep your right to cancel within the 14 day period, and you will be required to pay only a proportionate amount for the Services actually supplied to you up to the point you tell us you are cancelling. We will refund the balance within 14 days.
6.4 Where a domain name has already been registered or renewed on your instruction, that element of the Services has been fully performed and is not refundable, because the registration cannot be reversed.
6.5 To cancel, you need only make a clear statement to that effect. You may do so by raising a support ticket (our preferred route, because it is the quickest), by our live chat, or by any other clear statement, including by email or in writing to our registered office. To meet the deadline it is enough that you send your communication before the cancellation period expires.
6.6 This clause does not affect your other statutory rights.
7. 30 day money-back guarantee
7.1 In addition to any statutory right you may have, we offer a money-back guarantee on the Hosting Service. You may cancel the Hosting Service within 30 days beginning on the day after you receive the Acceptance Confirmation and receive a full refund of the price paid for that Hosting Service. Refunds are made to the payment method you used.
7.2 The guarantee is limited to one Hosting Service per customer.
7.3 To claim, raise a support ticket before the end of the 30 day period referred to in clause 7.1. We will respond to confirm your request. So that we do not delete data you may still need, we will ask you to confirm your request once; if you do not respond within 7 days we will contact you again before taking any action, and we will not delete your Material without having reached you.
7.4 The following are not covered by this guarantee:
(a) domain name registrations and renewals;
(b) private SSL certificates;
(c) virtual nameservers and other add-on products; and
(d) virtual private servers and associated products.
8. Duration and renewal
8.1 The Domain Service commences on the date of the Acceptance Confirmation and continues until the domain name registration is not renewed, or until we terminate it under clause 9.
8.2 All other Services commence on the date of the Acceptance Confirmation and continue for the minimum term applicable to the Service you purchased, as stated at the time of your order. After that minimum term they continue on a recurring basis until cancelled in accordance with clause 9.
8.3 We will not refund charges for a cancellation part-way through a billing period, except where clause 6 or clause 7 applies or where we are in breach.
9. Cancellation, suspension and termination
9.1 How you cancel. Consumers may cancel by any clear statement, as set out in clause 6.5. Business customers should cancel by raising a support ticket or through our live chat, so that the request is recorded and can be acted on promptly.
9.2 We will acknowledge every cancellation request. Because cancellation results in your Material being deleted, we will ask you to confirm the request once before we act on it.
9.3 We may terminate the Contract, or any part of it, by giving you at least 30 days’ notice to the email address registered to your account.
9.4 We may suspend or terminate the Services immediately on notice if:
(a) you are in material breach of these Terms, including clause 12 (acceptable use), and, where the breach is capable of remedy, you have not remedied it within 7 days of our notice;
(b) we are required to do so by law, by a regulator, or by a domain name registry; or
(c) your use of the Services presents an immediate risk to our infrastructure, our other customers, or any third party. In that case we will restore the Services as soon as the risk has passed, and will tell you what happened and why.
9.5 If we terminate under clause 9.3, we will refund a proportionate part of any charges you have paid in advance for Services not yet supplied.
9.6 Termination does not affect any rights or liabilities that have already accrued.
10. Service quality and availability
10.1 We will supply the Services with reasonable care and skill.
10.2 We will use reasonable endeavours to keep the Hosting Service available and to keep unplanned downtime to a minimum, but we do not warrant that access will be uninterrupted or error free. We will give reasonable advance notice of planned maintenance where we can.
10.3 If we are in breach of clause 10.1, we will use reasonable commercial efforts to remedy the breach promptly or, if we cannot, refund a proportionate part of the price. We will not be liable where the problem arises because you have failed to follow our instructions, have altered the Services without our written consent, or have misused the Services.
10.4 It is your responsibility to put in place the arrangements you need in order to access the Services, and to ensure that everyone who accesses the Services through your account is aware of these Terms.
11. Your Material and intellectual property
11.1 You retain all intellectual property rights in your Material. You grant us a worldwide, non-exclusive, royalty-free licence to host, store, copy and transmit your Material solely to the extent necessary to provide the Services to you and to comply with our legal obligations. This licence ends when the Services end, subject to clause 19.
11.2 You warrant that your Material does not infringe the rights of any third party and that you have the authority to grant the licence in clause 11.1.
11.3 Business customers only. You will indemnify us against claims, losses and reasonable costs arising from any allegation that your Material infringes the rights of a third party.
11.4 We retain all intellectual property rights in the Services and our software. You must not decompile or disassemble them except to the extent permitted by law.
11.5 We will defend you against any claim that the Services infringe a third party’s United Kingdom intellectual property rights, and will indemnify you against amounts awarded against you, provided that you notify us promptly, make no admission without our consent, give us sole conduct of the defence, and give us reasonable co-operation.
11.6 Any third-party software made available through us is licensed to you on that third party’s own terms, as notified to you at the time.
12. Acceptable use
12.1 You must not use the Services to store, publish, transmit or link to material which:
(a) is unlawful, or infringes the intellectual property, privacy or other rights of any person;
(b) is defamatory, obscene, or constitutes harassment;
(c) depicts, promotes or facilitates the sexual exploitation or abuse of children;
(d) promotes or facilitates terrorism, violence or unlawful discrimination;
(e) contains malware, or is designed to gain unauthorised access to any system; or
(f) is used to send unsolicited commercial email, or to operate phishing, fraud or other deceptive schemes.
12.2 You must not use the Services in a way that damages, disables or impairs our infrastructure, or that places an unreasonable load on it, or that interferes with any other customer’s use of it.
12.3 We do not routinely monitor your Material. Where we are notified of, or become aware of, material that breaches this clause 12, we may remove it or suspend the Services in accordance with clause 9.4, and we will tell you that we have done so and why.
12.4 You must also comply with the acceptable use requirements of 20i Ltd, whose platform hosts the Hosting Service, as they apply from time to time. The obligations in clauses 12.1 and 12.2 reflect those requirements. If 20i requires us to remove material or suspend a service, we must comply, and we will tell you as soon as we are able to, explain what has been required and why, and help you to resolve it.
13. Backups
13.1 You are responsible for maintaining your own current backups of your Material. We provide tools in the hosting control panel that allow you to take website and database backups at no additional charge, and we recommend you use them regularly.
13.2 We take backups of our servers for our own disaster recovery purposes. These are not a customer-facing backup service and are not a substitute for your own backups.
13.3 Where you ask us to restore your Material from a backup, we will use reasonable endeavours to do so, but we cannot guarantee that a usable backup exists or that a restore will be complete, in part because the underlying platform is operated by our infrastructure provider. We may charge a reasonable fee for a restore, which we will tell you about before carrying out the work.
13.4 We are not responsible for loss of or damage to your Material caused by you or by a third party acting through your account.
14. Hosting Service limits
14.1 Your hosting package includes the monthly bandwidth allowance, mailbox allowance and other limits set out on our website for that package at the time of your order.
14.2 We will notify you as you approach your bandwidth allowance. If the allowance is exceeded, we may suspend the Hosting Service until the start of the following calendar month or until you upgrade to a package with a higher allowance. You can monitor your usage in the control panel.
14.3 Unless your package includes a virtual private server, you may use up to 10% of a server’s processing capacity. We may permit you to exceed this, at our discretion. If your usage adversely affects other customers we will contact you to discuss your requirements before taking any action.
14.4 Mailboxes that have not been accessed for 100 consecutive days may be deleted. We will email the address registered to your account at least 14 days before deleting any mailbox on this basis.
15. Hosting location
15.1 Each Hosting Service is provisioned in a data centre region. Where more than one region is available for the hosting package you have selected, you choose the region when you place your order. Where only one region is available for that package, it is identified on our website before you complete your order.
15.2 At the date of these Terms, the only region available is the United Kingdom.
15.3 Your Material, and any personal data contained in it, will be stored and processed in the region provisioned for your Hosting Service, except that:
(a) backups taken by us or by our infrastructure provider may be held in datacentres located in the United Kingdom and the European Economic Area, as described in clause 13;
(b) your account, billing and support records are held by us as controller, as described in clause 19 and in our privacy notice; and
(c) data in transit may be routed through other locations, and where a content delivery network or similar caching service is enabled for your Hosting Service, cached copies of your Material may be held at edge locations outside the region.
15.4 If we make further regions available, clause 15.1 applies to them, and paragraph 7 of Schedule 1 (international transfers) governs any transfer of personal data to a country outside the Bailiwick of Guernsey, the United Kingdom and the European Economic Area.
15.5 We will not move your Hosting Service to a different region without your consent, unless we are required to do so for operational, technical or legal reasons. Where we are, we will give you at least 30 days’ notice unless a shorter period is unavoidable, and you may cancel the affected Service without penalty and receive a refund of the charges you have paid in advance for the unexpired part of the term.
15.6 We will tell you which region your Hosting Service is provisioned in at any time on request.
16. IP addresses
16.1 Any IP address allocated to you forms part of the Hosting Service. You acquire no right, title or interest in it, and it is not portable or transferable by you.
16.2 If we need to renumber or reallocate an IP address, we will use reasonable endeavours to avoid disruption to you and will give you as much notice as we reasonably can.
17. Domain names
17.1 Where the Contract includes the Domain Service, we will use reasonable endeavours to register the domain name you request. We are not liable if the relevant registry refuses, suspends or revokes a registration.
17.2 Registration and continued use of a domain name is subject to the registry’s own terms. You are responsible for making yourself aware of, and complying with, those terms.
17.3 A domain name is registered only once you appear as the registrant on the relevant registry’s WHOIS record.
17.4 You warrant that you own, or are authorised by the owner of, any trade mark in a domain name you ask us to register, and that you are the legal owner of, or authorised to use, any domain name you use with the Hosting Service.
17.5 We may require you to select a different domain name, and may suspend or terminate the Domain Service, if we reasonably believe your chosen name is registered in bad faith or breaches these Terms or any legal or regulatory requirement.
17.6 Domain names must be renewed periodically. We will send renewal notices to the email address registered to your account 30 days and 7 days before the renewal date.
17.7 Unless you have cancelled the Domain Service, you authorise us to renew the domain name automatically and to charge the renewal fee to your registered payment method. The renewal price is shown in the renewals section of your account.
17.8 We may apply registry locks to a domain registered through us, at registration or afterwards, to protect against unauthorised transfer. We will remove a lock on your request where the registry permits.
17.9 You may transfer a domain name away from us at any time, subject to the registry’s rules. We will not unreasonably withhold or delay an authorisation code.
18. Support
18.1 We provide support for the Services through our online support ticket system and live chat. We do not provide telephone support.
18.2 Our support covers the operation of the Services. It does not include programming, website development, or support for software you install or license separately. Our servers are compatible with a range of programming languages, but we do not provide programming support.
19. Data protection, retention and deletion
19.1 We are established in the Bailiwick of Guernsey. Our processing of personal data is governed by the Data Protection (Bailiwick of Guernsey) Law, 2017, and we are registered with the Office of the Data Protection Authority. Where the UK GDPR or the EU GDPR applies to a particular processing activity, we will also comply with the applicable requirements of that legislation.
19.2 Where we process personal data contained in your Material, we do so as a processor acting on your instructions, and you act as controller. Schedule 1 sets out the terms on which we do so.
19.3 Our privacy notice explains how we handle personal data for which we are the controller, including your account and billing information. It is available at https://www.smudgehosting.com/privacy
19.4 Retention and deletion. On cancellation or termination of a Service:
(a) your websites and other hosted Material will be deleted from our live systems;
(b) your Material will remain recoverable from our backups for 30 days, during which you may ask us to restore it under clause 13.3, after which it is permanently deleted;
(c) we will retain your account records for 1 year following cancellation of all your Services, and will then delete them; and
(d) we will retain accounting records, including invoices and records of payment, for 6 years, because we are required to do so by section 239 of the Companies (Guernsey) Law, 2008 and by applicable tax legislation. We will not use those records for any purpose other than complying with those obligations.
19.5 Export before you go. You may export your Material at any time while the Services are active, using the tools in the control panel. We strongly recommend you do so before cancelling. If you need help exporting, raise a support ticket before you cancel and we will assist.
20. Separately licensed software
20.1 These Terms govern the Hosting Service and the Domain Service only. Where you separately license software from us or from a third party, that licence governs your use of that software and, in respect of the software, prevails over these Terms.
20.2 Support, warranties, service levels and data protection arrangements for separately licensed software are provided under that licence and not under these Terms. Hosting a piece of software on our infrastructure does not make us responsible for how it functions.
20.3 Nothing in clause 25.5 (entire agreement) operates to supersede or vary any separate software licence between us.
21. Our liability
21.1 Nothing in these Terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for any other liability which cannot lawfully be limited or excluded.
21.2 We do not monitor and are not liable for your Material or for any communication you transmit using the Services, save where we are notified of unlawful content and fail to act.
21.3 Because of the nature of the internet, we cannot guarantee the security or privacy of information in transit across networks we do not control.
21.4 We implement appropriate technical and organisational measures to protect the Services and your Material, as described in Schedule 1. We do not warrant that the Services will be free from all security incidents, but that does not limit our obligation to maintain those measures.
21.5 Consumers. We are responsible for loss or damage you suffer that is a foreseeable result of our breach of these Terms or our failure to use reasonable care and skill. We are not responsible for loss or damage that is not foreseeable, or for loss arising from your use of the Services for any business purpose.
21.6 Business customers. We will not be liable, whether in contract, tort (including negligence) or otherwise, for loss of profits, revenue, business, anticipated savings, goodwill, or for any indirect or consequential loss.
21.7 Business customers. Our total aggregate liability arising under or in connection with the Contract shall not exceed the total charges paid by you for the Services in the 12 months preceding the event giving rise to the liability. This cap does not apply to liability under clause 21.1 or to our indemnity at clause 11.5.
21.8 Where a failure of the Hosting Service is caused by our infrastructure provider, we will pursue any remedy available to us under our contract with them and will pass on to you any credit or refund we recover that is attributable to your Services. This does not limit any other right you have against us under these Terms.
21.9 We recommend that business customers maintain business interruption or other appropriate insurance.
22. Third party websites and services
22.1 We may link to third-party websites. We give no undertaking as to the quality of products or services obtained from them, and any such warranties are excluded. This does not affect your statutory rights against that third party.
23. Events outside our control
23.1 We will not be liable for any failure or delay in performing our obligations caused by an event outside our reasonable control (a “Force Majeure Event”), including: interference with our systems by you or a third party, including hacking and malware attacks; strikes or industrial action; civil commotion, riot, terrorist attack, or war; fire, explosion, storm, flood, earthquake, epidemic or other natural disaster; failure of public or private telecommunications networks; and the acts or restrictions of any government.
23.2 Our obligations are suspended for the duration of a Force Majeure Event and we will have an extension of time for performance. We will use reasonable endeavours to bring it to an end or to find a workaround. If a Force Majeure Event continues for more than 30 days, either of us may terminate the affected Services on notice, and we will refund charges paid in advance for Services not supplied.
24. Communications and notices
24.1 You accept that our communications with you will be mainly electronic. We will contact you by email at the address registered to your account, or by posting notices in your account or on our website. You agree that this satisfies any legal requirement that communications be in writing. This does not affect your statutory rights.
24.2 You should send notices to us through our online support system. Consumers may also give notice by email or in writing to our registered office.
24.3 Service and security notices. We will send you operational messages about your Services — including billing, planned maintenance, security notices and changes to these Terms. These are not marketing messages and you cannot opt out of them while you hold an account with us.
24.4 Marketing. We may send you occasional information about our own similar products and services by email. You may opt out at the point you register and in every message we send, by using the unsubscribe link or by raising a support ticket. Opting out of marketing does not affect the notices described in clause 24.3.
25. General
25.1 Changes to these Terms. We may revise these Terms from time to time. We will give you at least 30 days’ notice of any change that materially affects your rights, and you may cancel the affected Services without penalty before it takes effect. You are subject to the Terms in force when you order, except where a change is required by law or by a regulator, in which case it applies to existing Contracts.
25.2 Transfer. You may not transfer or assign your rights or obligations under the Contract without our prior written consent, which we will not unreasonably withhold. We may transfer or assign our rights and obligations, provided this does not adversely affect your rights. We will tell you if we do.
25.3 Third party rights. A person who is not a party to the Contract has no right to enforce any of its terms under the Contracts (Rights of Third Parties) Act 1999.
25.4 Waiver and severability. If we do not insist that you perform an obligation, or delay in enforcing a right, that is not a waiver and does not prevent us from enforcing it later. If any provision is found to be invalid or unenforceable, it will be severed and the remaining provisions will continue in force.
25.5 Entire agreement. These Terms, together with Schedule 1 and the documents expressly referred to in them, constitute the entire agreement between us in relation to the Services and supersede any previous agreement in relation to those Services. This clause does not apply to, and does not supersede, any separate software licence between us, as set out in clause 20. Nothing in this clause limits liability for fraudulent misrepresentation.
26. Governing law and jurisdiction
26.1 The Contract is governed by English law, and the courts of England and Wales have exclusive jurisdiction, save that if you are a consumer resident in Guernsey, Jersey, Scotland or Northern Ireland you may also bring proceedings in the courts of the place where you live.
26.2 English is the only language offered for the conclusion of the Contract.
26.3 Clause 26.1 does not affect the application of the Data Protection (Bailiwick of Guernsey) Law, 2017 or of any other data protection legislation that applies to us or to you.
SCHEDULE 1
Data Processing Terms
These Data Processing Terms form part of the Terms of Service and apply whenever we process personal data on your behalf in the course of providing the Services.
1. Definitions and roles
1.1 “Data Protection Legislation” means the Data Protection (Bailiwick of Guernsey) Law, 2017 and any subordinate legislation made under it, and, where they apply to a particular processing activity, the UK GDPR and the Data Protection Act 2018, and Regulation (EU) 2016/679 (the EU GDPR).
1.2 “controller”, “processor”, “personal data”, “data subject”, “processing” and “personal data breach” have the meanings given in the Data Protection Legislation.
1.3 For personal data contained in your Material, you are the controller and we are the processor. You are responsible for establishing a lawful basis for the processing and for providing any required privacy information to data subjects.
1.4 For personal data in your account and billing records, and in our own operational logs, we are the controller and our privacy notice applies.
2. Details of the processing
Required by Article 28(3) of the UK and EU GDPR and the equivalent provision of the Guernsey Law:
|
Item |
Detail |
|
Subject matter |
Provision of the Hosting Service and Domain Service. |
|
Duration |
The term of the Contract, plus the retention periods set out at clause 19.4 of the Terms. |
|
Processing location |
The data centre region provisioned for your Hosting Service under clause 15 of the Terms, in facilities operated by 20i Ltd as our sub-processor. At the date of these terms that region is the United Kingdom. Backups may be held in the United Kingdom and the European Economic Area. |
|
Nature and purpose |
Hosting, storage, transmission, backup and deletion of your Material, and the technical operations necessary to keep the Services running and secure. |
|
Types of personal data |
Whatever personal data you choose to store on or transmit through the Services. We do not select or control this. It may include names, contact details, account credentials, transaction records, images and any other category you upload. |
|
Categories of data subject |
Whichever categories your own processing concerns — typically your customers, employees, suppliers and website visitors. |
|
Special category data |
You must tell us in writing before storing special category or criminal offence data on the Services, so that we can confirm whether additional measures are required. |
3. Our obligations
We will:
(a) process personal data only on your documented instructions, which include your use of the Services and any instruction given through your account or a support ticket, unless we are required to process by law, in which case we will tell you before doing so unless the law prohibits it;
(b) tell you if, in our opinion, an instruction from you infringes the Data Protection Legislation;
(c) ensure that anyone authorised to process personal data is subject to a duty of confidence;
(d) implement appropriate technical and organisational measures to protect personal data, as set out in paragraph 4;
(e) notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your personal data, and provide the information you reasonably need in order to meet your own notification obligations;
(f) assist you, taking into account the nature of the processing and the information available to us, in responding to requests from data subjects exercising their rights;
(g) assist you with data protection impact assessments and prior consultation with a supervisory authority, so far as this relates to our processing;
(h) delete or return personal data at the end of the Services in accordance with clause 19.4 of the Terms, and confirm deletion in writing on request; and
(i) make available the information reasonably necessary to demonstrate compliance with this Schedule, and allow for and contribute to audits, in accordance with paragraph 6.
4. Security measures
4.1 The infrastructure on which the Hosting Service runs is operated by 20i Ltd, which implements technical and organisational measures in accordance with Article 32 of the UK GDPR. A description of those measures is available from us on request.
4.2 In addition, we maintain the following measures within our own control:
(a) administrative access to customer environments is limited to named individuals who need it, using individual accounts protected by multi-factor authentication;
(b) access to customer environments is logged;
(c) customer data is transmitted over encrypted connections, and TLS certificates are provided for hosted websites;
(d) personnel with access to personal data are bound by a duty of confidence; and
4.3 You are responsible for the security of the applications, plugins, themes and code you install, for keeping them updated, and for the strength and confidentiality of your account credentials. A large majority of website compromises originate in out-of-date customer software rather than in hosting infrastructure.
5. Sub-processors
5.1 You give us general authorisation to engage sub-processors. Our sub-processors are:
(a) 20i Ltd (England and Wales) — hosting infrastructure, datacentre operations, platform backups and domain name provisioning. 20i operates datacentres in the United Kingdom and in other countries. The region used for your Hosting Service is determined under clause 15 of the Terms, and 20i holds platform backups in the United Kingdom and the European Economic Area.
(b) 20i in turn engages its own sub-processors, currently Stripe (payment processing), Nominet and Tucows/OpenSRS (domain names), GeoTrust/Symantec (TLS certificates), Google Analytics (control panel analytics) and Xero (accounting). We will pass on any change 20i notifies to us.
5.2 We impose data protection obligations on each sub-processor that are no less protective than those in this Schedule, and we remain fully liable to you for their performance.
5.3 We will give you at least 30 days’ notice before adding or replacing a sub-processor within our control. If you reasonably object on data protection grounds, you may terminate the affected Services without penalty and receive a refund of charges paid in advance. Where a change is made by 20i to its own sub-processors, we will notify you as soon as we are notified.
6. Audit
6.1 On at least 30 days’ written notice, and no more than once in any 12 month period unless required by a supervisory authority or following a personal data breach, we will provide the information reasonably necessary to demonstrate our compliance with this Schedule.
6.2 Where that information is not sufficient, we will allow an audit by you or an independent auditor appointed by you, at your cost, during business hours and in a manner that does not disrupt our other customers or compromise their confidentiality.
6.3 Audit of the underlying hosting infrastructure is subject to the terms our infrastructure provider imposes on us, which allow an audit on 30 days’ notice and no more than once in any 12 month period. We will pass on a reasonable audit request and provide whatever the provider makes available to us.
7. International transfers
7.1 Personal data processed under these terms is stored in the data centre region provisioned for your Hosting Service under clause 15 of the Terms, in facilities operated by our infrastructure provider. At the date of these terms that region is the United Kingdom. Backups may be held in datacentres located in the United Kingdom and the European Economic Area.
7.2 We will not transfer personal data to a country outside the Bailiwick of Guernsey, the United Kingdom or the European Economic Area unless an adequacy decision applies, or an appropriate transfer mechanism is in place — including the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism. We will tell you which mechanism we rely on if you ask.
7.3 Guernsey benefits from an adequacy decision from the European Commission, and is recognised as adequate for the purposes of UK data protection law, so transfers to us from the UK and the EEA do not require an additional transfer mechanism.
8. Your obligations
8.1 You warrant that you have a lawful basis for the processing you instruct us to carry out, that you have provided any required privacy information to data subjects, and that your instructions comply with the Data Protection Legislation.
8.2 You are responsible for responding to data subject requests relating to your Material. Where a data subject contacts us directly about your Material, we will refer them to you and tell you promptly.
9. Duration
9.1 This Schedule applies for as long as we process personal data on your behalf, and the obligations in paragraphs 3(c), 3(h), 4 and 6 survive termination for as long as we hold any of your personal data.